Privacy Policy

Reservelly is a booking app for beauty professionals, independent specialists, and salons.

Controller responsible for processing personal data:

Anatolii Artemenko
IČO: 22520431
Sokolská 1883/8, 120 00 Praha 2 – Nové Město, Czech Republic
Email: tolik.artemenko@gmail.com

Registered in the Trade Licensing Register of the Czech Republic, Úřad městské části Praha 2.

This policy explains what data we collect, why, and what you can do about it.

When you register and use the app, we process:

• Account: email, name, password (encrypted — we never see it in plain text), phone number.
• Profile: profile photo, bio, specialty, work address, work schedule, social media links.
• Business data: services and prices, products, expenses, public page settings.
• Technical data: IP address, device type, app version, language, time zone, session and device sign-in data.
• Push notification device tokens — if you use the mobile app and have allowed notifications.

Legal basis: performance of a contract (providing the service); for technical data — legitimate interest (security and reliability of the service).

This is a separate category, described separately, because it concerns people who never registered with Reservelly themselves.

What is processed: name, phone number, email (if provided), messenger contacts, date of birth, visit history, the professional's private notes, before/after photos of work, treatment formulas, pre-treatment questionnaires, reviews.

Our role. For this data we act as a processor, and the professional acts as the controller. This means the professional decides what data to enter and why, and is responsible for having a valid legal basis for processing it. We process this data only on their instructions and to operate the service.

The professional's obligations. By using Reservelly, the professional confirms they have the right to enter their clients' data and, where required, has obtained their consent — in particular for storing photos and publishing work in a portfolio.

Publishing photos. Photos appear in the public portfolio only if the professional explicitly marked them for publishing at upload time. By default, they are private.

Public page guest data. When a client books a visit through the professional's page, we process their name, phone number, and comment — to create the booking and send a confirmation. This data is passed on to the professional.

Notifications to clients. Depending on the professional's settings, we may send the client a booking confirmation and reminders via Telegram or email. For this, the client's contact information is passed to the relevant communications provider (see Section 8). These notifications are transactional — necessary to fulfil the booking, not for marketing.

Subscription payments are processed by Stripe. We do not receive or store your card details — they are sent directly to Stripe. We only store your Stripe customer ID, subscription status, and transaction amounts and dates.

Reservelly is not designed for the systematic collection of health data, racial or ethnic origin, religious beliefs, biometric data, or other special categories of personal data.

⚠️ At the same time, in the beauty industry, some of a professional's records may contain information that qualifies as health data: allergies, reactions to products, skin or nail condition, contraindications, treatment formulas, before/after photos.

The professional's responsibility. If the professional enters such information into notes, formulas, questionnaires, or photos, they are solely responsible for having a valid legal basis — for special categories under the GDPR, this is generally the client's explicit consent. We provide the technical capability to store this data but do not determine the purpose of its collection.

This data is never published or shared with other professionals or accounts.

Creating a professional account is available to persons who are at least 18 years old.

A professional's clients may be minors. If the professional enters a minor client's data, they are obliged to ensure a valid legal basis exists and, where required, obtain the consent of a parent or legal guardian — especially regarding photos and health-related data.

We do not knowingly collect children's data directly.

If you work in a salon or team, the account owner can grant other members access to client data, bookings, and financial information according to configured roles.

The account owner is responsible for: correctly configuring access permissions, choosing who is granted access, promptly revoking access for people who no longer work there, and ensuring team members use the data in accordance with the law.

We keep a technical log of account activity for security and incident investigation purposes.

We do not sell your data and do not share it for advertising purposes. Data is processed by these service providers:

Transfers outside the EEA are carried out on the basis of Standard Contractual Clauses (SCCs) or other legally provided safeguard mechanisms.

• Account data — for as long as the account is active
• After account deletion — data is deleted within 7 days
• Financial documents — retained for the period required by law
• Activity log (audit log) — retained with personal data anonymized
• Logs and technical data — up to 90 days

Backups. After data is removed from operational systems, copies may temporarily remain in database backups until scheduled overwriting. This data is not used for regular operations and is deleted along with outdated backups.

What is retained after account deletion, and why:

• Financial transactions — accounting and tax record-keeping obligations
• Activity log entries — in anonymized form, for security and incident investigation
• Data needed to defend legal claims, if any arose before deletion

You have the right to:

• Obtain a copy of your data — in the app: Settings → Download my data. The archive is generated automatically, after which we send a notification to your email that it's ready. The archive itself is not sent by email: it is stored in secure storage, and can be downloaded from a page in the app via a temporary link valid for 15 minutes that is regenerated each time you download.
• Delete your account — in the app: Settings → Delete account. Deletion is irreversible and covers all your data, including the client data you entered.
• Correct your data — in the Profile section.
• Restrict processing or object to it.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with a data protection supervisory authority. For us, this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, uoou.gov.cz. You may also contact the supervisory authority of your own country of residence.

Requests: tolik.artemenko@gmail.com. We respond within 30 days.

If you are a professional's client and want your data deleted — please contact the professional you booked with directly, since they control that data. You may also write to us, and we will forward your request.

Data is transmitted over a secure connection (HTTPS). Passwords are stored in hashed form. Access to one account's data from another account is not possible — this is enforced at the database level. Staff access to user data is restricted and logged.

No information system guarantees absolute security, but we take reasonable and proportionate measures to reduce risk. You are also responsible for keeping your account credentials safe.

If we become aware of a personal data security breach, we will assess its nature, scope, and likely consequences.

If the breach poses a risk to the rights and freedoms of individuals, we will notify the supervisory authority (ÚOOÚ) within 72 hours of becoming aware of it, and in the case of high risk, notify the affected individuals directly, as required by the GDPR.

A professional can create a public booking page. Information they knowingly make public — name, work photos, services, prices, schedule, contact details — is accessible to an unlimited number of people and may be indexed by search engines.

The professional independently determines the content of the page and must not publish other people's personal data without a valid legal basis — in particular, client photos without their consent.

We may create statistical and aggregated data sets that do not allow identification of a specific individual — for analyzing feature usage, diagnostics, and service development. If such information no longer allows a person to be identified, it is not considered personal data.

The service may contain links to third-party sites and services. We do not determine how such third parties process data — we recommend reviewing their own privacy policies.

We use cookies that are necessary for the service to function: keeping you signed in, and remembering your language and theme settings. We do not use advertising or tracking cookies.

To avoid any misunderstanding, we specifically state:

• We do not build a cross-professional client rating. Client data entered by one professional is not visible to other professionals and is not used to evaluate the client anywhere else in the service.
• We do not maintain a shared client blacklist.
• We do not sell personal data and do not share it for third-party advertising.
• We do not use a professional's client data for our own marketing.

If in the future we introduce functionality involving automated decision-making or profiling with legal or similarly significant effects on a person, we will notify you separately and provide the safeguards required by law.

We may update this policy. We will notify you of material changes by email or in the app. The date of the last update is shown at the top.

Questions about this policy and requests regarding your data: tolik.artemenko@gmail.com